If ClearPass profiled it, the device should still be in the endpoint database even if the user is not online anymore.
Within the Endpoints Database (Configuration --> Identity --> Endpoints), have a look at the profile fingerprint for that MAC address to determine how it was categorized. For example, this one was profiled by both DHCP and HTTP User Agent.
Or as Tim suggests, check what the controller profiled it as as well in Access Tracker: